What FeedmindBot is, what it fetches, and how to let it through.
You are probably here because this URL appeared in your server logs or in a bot report. FeedmindBot reads a small sample of public product pages when a person asks Feedmind how ready a shop is for AI assistants. It does not crawl continuously, it does not train models, and it does not need an account with us to be blocked. Everything it does is on this page.
One bot, one user agent, one operator.
- User-Agent
- FeedmindBot/1.0 (+https://getfeedmind.com/bot)
- robots.txt token
- FeedmindBot (matching is case insensitive, so feedmindbot works too)
- Operator
- Feedmind S.à r.l. (in formation), Luxembourg City, Grand Duchy of Luxembourg
- Purpose
- On demand AI readiness scanning of a public storefront, requested by a person who typed the domain into getfeedmind.com or connected the store.
- Contact
- crawler@getfeedmind.com reaches a human. One operator reads it, and a request to stop is honoured without an account.
- Key directory
- /.well-known/http-message-signatures-directory on getfeedmind.com
A sample, once, on request.
A scan is a handful of GET requests, spread out, then nothing. There is no recurring crawl of your store unless a merchant connects it and asks for one.
Your homepage, robots.txt, sitemap and about twelve product pages.
Your homepage, your robots.txt, your sitemap when one is declared, and roughly twelve product pages found from those. Nothing else.
GET only, and it reads what your server returns.
GET only. No forms, no cart, no checkout, no login, no search parameters. It reads the HTML your server returns and does not execute JavaScript, because that is what an assistant reads too.
Once per scan, and a result is reused for fourteen days.
Once per scan. A result is reused for fourteen days, so repeat visitors to the same scorecard cost your server nothing.
One request at a time, a second apart.
One request at a time per host, with a minimum gap of one second between them. Concurrency against a single shop is never raised to go faster.
Honoured, and a long one costs you sample rather than politeness.
Honoured, including values longer than our own floor. A delay long enough to make a full sample slow reduces the number of pages we read rather than the gap between them, so your rule is never quietly ignored.
Every request is signed, so you never have to trust the user agent string.
A user agent is a claim anyone can copy. FeedmindBot signs its requests with HTTP Message Signatures (RFC 9421) under the Web Bot Auth scheme, using an Ed25519 key published in our directory. Verify the signature and you know the request is ours.
- Signature-Agent
- "https://getfeedmind.com", the origin that hosts our key directory.
- Signature-Input
- Covers "@authority" and "signature-agent", with created, a short expires, keyid, alg="ed25519", a nonce and tag="web-bot-auth".
- Signature
- The Ed25519 signature over those components.
- Public key
- Served as a JWKS at /.well-known/http-message-signatures-directory. The directory response is itself signed, so a mirror of it proves nothing.
Enrolment with bot mitigation providers is in progress. Being verifiable is not the same as being on an allowlist by default, and we would rather say which one is true today.
Two lines in robots.txt, one rule in your WAF.
Our reader identifies as FeedmindBot/1.0. Allowing it is one rule in your WAF. While you are there, the assistant crawlers worth allowing are GPTBot, PerplexityBot, ClaudeBot and Google-Extended.
User-agent: FeedmindBot Allow: / Crawl-delay: 1
FeedmindBot/1.0 GPTBot PerplexityBot ClaudeBot Google-Extended
If your shop sits behind bot protection and we are challenged, we say so instead of scoring you. A blocked scan returns a bot wall result, never a low grade you did not earn.
Disallow it, and it stops. No account needed.
User-agent: FeedmindBot Disallow: /
Already scored, and you want it gone
Email crawler@getfeedmind.com with the domain. We remove the public scorecard, stop future scans of that domain, and reply to confirm. There is no form and no account step.
Robots is checked first
A disallowed path is never fetched, and a disallowed store never gets a scorecard.
Opt out is durable
The block survives a rescan request from anyone, including a merchant who connects the store later.
Also published as
A markdown mirror at /bot.md for machine readers, and listed in llms.txt.